PT-2026-81950

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm user id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping...

Tenable Security Center Report Charting Remote Code Execution

This Metasploit module demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated, non-administrative user to achieve code execution as the web service account tns through report generation. This module requires Metasploit: https://metasploit.com/download Current...

CVE-2026-47841: Undefined Security Weakness

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098892)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098892 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxf...

Linux Distros Unpatched Vulnerability : CVE-2026-68569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the...

Fedora 44 : python-tablib (2026-eaa6ecd43e)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eaa6ecd43e advisory. Resolves: https://nvd.nist.gov/vuln/detail/CVE-2026-9318 Tenable has extracted the preceding description block directly from the Fedora security advisory. No...

PT-2026-82277

On Aug 25, @Plesk disclosed 3 flaws, all with fixes. CVE-2026-65647 can let an unprivileged Plesk user execute code as root. A panel update isn’t enough. Check: 🔷 Panel: 18.0.79.8 or 18.0.80.4 🔷 Migrator: 2.36.0 🔷 Site Import: 1.12.1 https://t.co/nZ4vI5KEqt...

CVE-2026-16809: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

CVE-2026-43621: Incorrect Authorization

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

PT-2026-82233

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Description An application using WebAuthn support may be vulnerable to user...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

PT-2026-82191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cs40l50 add function where custom data from an FF PERIODIC or FF CUSTOM effect is copied from user space via EVIOCSFF without sufficient validation of the custom l...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcp (UTSA-2026-093148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093148 advisory. A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUS...

Linux Distros Unpatched Vulnerability : CVE-2026-80575

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the...

Linux Distros Unpatched Vulnerability : CVE-2026-48549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie...

FreeBSD : FreeBSD -- Kernel use-after-free via tty ioctls (a34b5154-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a34b5154-a0ff-11f1-ae1f-bc241121aa0a advisory. The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After...

FreeBSD : FreeBSD -- Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl (226751fb-a0fe-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 226751fb-a0fe-11f1-ae1f-bc241121aa0a advisory. The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking ...

Unity Linux 20.1060a / 20.1070a Security Update: abrt (UTSA-2026-104826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104826 advisory. A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries...

PT-2026-81960

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...